The backdoor attackers aim to embed a backdoor, also known as trigger, in the training data in order to corrupt the performance of the Deep Neural Network. Given it involves poisoning data, it belongs to the fields of data poisoning attacks, which has been widely explored in multiple machine learning fields, including Support Vector Machines, Statistical Machine Learning, and DL [1]}, [2]}. In DL, current studies mainly explore poisoning attacks in centralized classification models, where a hidden trigger is pasted on some of the training data with wrong labels. The attacker activates it during the testing time so that the classification model produces a lower testing accuracy for images with triggers [3]}. This attack strategy takes advantage of the tendency that the deep neural network is more likely to learn the pattern of the backdoor instead of the actual image [4]}.
